Executive Summary 
Validation of the Nationwide Suspicious 
Activity Reporting (SAR) Initiative 
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° Background Study Objectives 
e The Nationwide Suspicious Activity Reporting (SAR) Initiative The START study leveraged data on terrorism cases 
(NSI) is a standardized process that includes stakeholder and associated SAR indicators from two open source 
outreach, privacy protections, training, and facilitation of terrorism projects—the Extremist Crime Database 
e technology for the purpose of identifying and reporting (ECDB), which is maintained by the ECDB staff at the 
terrorism-related suspicious activity in jurisdictions across John Jay College of Criminal Justice and Michigan 
e@ the country. The decision to share this type of reporting State University, and the American Terrorism 
is primarily based upon a determination of whether or Study (ATS), maintained by the Terrorism Research 
not a SAR aligns with 1 or more of the 16 behavioral Center at the University of Arkansas. The following 
indicators that are outlined in the Information Sharing four general questions guided the research: 
Environment (ISE) SAR Functional Standard (http://nsi. 
ncirc.gov/documents/SAR_ FS 1.5.5 PMISE.pdf) as being @ What is the prevalence of terrorists’ 


pre-incident activities aligning with 
the Functional Standard’s 16 ISE-SAR 
indicators, and how does that vary by 


observed behaviors reasonably indicative of preoperational 
planning related to terrorism or other criminal activity. 


In order to review the validity of the 16 categories of terrorism movement and crime type? 


indicators contained in the ISE-SAR Functional Standard, the @ ‘To what extent are SAR indicators 


University of Maryland’s National Consortium for the Stud 


observable versus actually observed, 
of Terrorism and Responses to 


Terrorism (START) recently undertook 


an initiative to compare pre-incident 


and how does this vary by terrorism 
movement and crime type? 


© How do SAR indicators relate to 
“successful” resolution of terrorism cases? 


activities of terrorists and violent 


criminal extremists in the United tose 
States, or “SAR indicators,” to the 

16 SAR categories. START released 

its findings in the Validation of the 
Nationwide Suspicious Activity 
Reporting (SAR) Initiative (NSI) report. 


@® What are examples of pre-incident 
activity committed by terrorists that 
do not align with the Functional 
Standard’s 16 ISE-SAR categories, and 
how prevalent are such exceptions? 
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ECDB Findings 


e Inthe 48 terrorism cases that were selected for the study, a total of 255 preoperational ISE-SAR indicators 
were identified. 


¢ 47 percent of the identified indicators (121 of 255) were classified as observable. 


Study Findings 


¢ 59 percent (72 of 121) of the observable indicators were actually observed/reported. 


e Weapons discovery, materials acquisition/storage, acquisition of expertise, and observation/surveillance 
accounted for 57% of the observable noncriminal ISE-SAR indicators. 


ATS Findings 


e Inthe 303 terrorism cases studied, e 
2,541 precursor behaviors were 
identified. 
¢ 80 percent (2,032) of the ° 


identified pre-incident indicators 
aligned with 1 of the 16 ISE-SAR 
indicators. 


¢ The 7 most commonly identified 
ISE-SAR indicators accounted for e 
79 percent (2,011 of 2,541) of 

the overall precursor behaviors 
identified in the 303 cases: 


= Materials acquisition (497) 
= Weapons acquisition (380) 
Threat (374) 

= Misrepresentation (334) 

=" Acquiring expertise (196) 
= Surveillance (160) 

=~ Recruiting (70) 


Study Findings (continued) 


Conclusions 
The START study verifies the utility of the NSI, which 


provides law enforcement and homeland security agencies 


with a uniform method for gathering and reporting raw 
tips, leads, and reports of suspicious activity. This data is 


reviewed and vetted by trained fusion center personnel using 


established standards. From an analytical perspective, the 
study supports how the vetting efforts of trained analysts 
may ultimately lead to the enhancement of terrorist 
investigations. Furthermore, analysts’ reliance upon the 


established 16 ISE-SAR behaviors is validated by this study and 


will ultimately assist them in the potential reporting of SAR 


and the development of products that use and evaluate SAR. 


The START research illustrates that those involved 

in preoperational planning related to terrorism do 
participate in tangible behaviors that align with the 
ISE-SAR Functional Standard. The study found that not 
only were many of the indicators observable prior to 
terrorist attacks, but there was also evidence that some 
indicators were observed by the public. These findings 
reflect the importance of the observation and subsequent 
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99 percent (2,011 of 2,032) of the ISE-SAR pre-incident activities 
identified in the study align with one of the aforementioned 7 most 
commonly identified indicators. 


Terrorist Failure Rate: The study revealed that terrorists who engaged 
in the following five ISE-SAR activities were significantly less likely 

to complete the planned terrorist incident: materials acquisition, 
weapons acquisition, threat prior to incident, expertise acquisition, 
and surveillance. 


20 percent (509 of 2,541) of the identified pre-incident activities 
associated with the 303 terrorism cases were not classified as an ISE- 
SAR indicator. 


The majority of the 509 non-ISE-SAR activities involved three 
types of actions: meetings; other forms of communication, such 
as e-mails and phone calls; and travel. 


¢ The study characterized the 509 non-ISE-SAR activities as those 
that are typically noncriminal and tend to occur most often in the 
early stages of planning. 


reporting of such tips, leads, and suspicious behaviors. 
Although an action or an activity reported may not seem 
significant, when reviewed and/or combined with other 
similar actions or activities, it may become an essential 
element in preventing criminal or even terrorist activity. 


The findings can also be leveraged to inform training and 
outreach enhancements. For example, the START study 
outlines the existence of missed opportunities to identify 
behaviors indicative of preoperational planning related to 
terrorism. There are instances when individuals involved in 
preoperational acts linked to terrorism openly displayed 1 

or more of the ISE-SAR 16 behaviors and were not reported. 
Such a finding is a reminder of the importance of public 
outreach and awareness, as well as SAR training for frontline 
officers and homeland security partners, regarding reporting 
suspicious activities. These findings also validate the relevance 
and continued importance of maintaining NSI SAR training that 
is delivered via a partnership between the U.S. Department of 
Homeland Security and the Federal Bureau of Investigation. 


